Incorrect OID usage when calling request-certificate with --attestation flag.

[jcspencer]

Hi there!

When calling request-certificate, one can pass in the --attestation flag to include the attestation flag in extensions stapled to the CSR:

$ yubico-piv-tool -a generate -s 9c -A RSA2048 -o pub.key
Successfully generated a new private key.

$ yubico-piv-tool -a verify-pin -a request-certificate --attestation -s 9c -S '/CN=digi_sign/OU=test/O=example.com/' -i pub.key -o csr.pem

I have noticed is that the OID used to staple the attestation to the CSR, 1.3.6.1.4.1.41482.3.11 used here and here is different from what is defined in the PIV Attestation OID Arc documentation.

From my understanding, it should likely be 1.3.6.1.4.1.41482.3.1, as referenced in the Yubikey OID reference:

• 1.3.6.1.4.1.41482.3.1: Attestation data and signature
• 1.3.6.1.4.1.41482.3.2: Attestation certificate
• 1.3.6.1.4.1.41482.311: CSPN

More than happy to create a PR for this, but I was curious if the .11 OID is either a typo, or was used as a "new" value - outside of the OID spec at the time of implementation - that has subsequently been assigned to CSPN?

Thanks!